Read the docs
TI-2025-00833 Aliases CVE-2025-0986GHSA-9qmj-p674-g42j

IBM PowerVM Hypervisor data manipulation

Priority LOW 20CWE-409Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
None
Attack complexity
High
Impact type
—
Confidentiality · integrity · availability
None · Low · Low
Fix status
No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

IBM PowerVM Hypervisor FW1050.00 through FW1050.30 and FW1060.00 through FW1060.20 could allow a local user, under certain Linux processor combability mode configurations, to cause undetected data loss or errors when performing gzip compression using HW acceleration.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00131 2nd percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
IBMPowerVM HypervisorFW1050.00 – FW1050.30; FW1060.00 – FW1060.20—No fix listedCNA
  • PowerVM Hypervisor VendorIBM Affected FW1050.00 – FW1050.30; FW1060.00 – FW1060.20 Fixed in — No fix listed CNA

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:o:ibm:powervm_hypervisor:*:*:*:*:*:*:*:*fw1050.00 – fw1050.30; fw1060.00 – fw1060.20VulnerableIBM
cpe:2.3:h:ibm:powervm_hypervisor:-:*:*:*:*:*:*:*not specified by NVDRunning onIBM
  • cpe:2.3:o:ibm:powervm_hypervisor:*:*:*:*:*:*:*:* Versions fw1050.00 – fw1050.30; fw1060.00 – fw1060.20 Vulnerable ·IBM
  • cpe:2.3:h:ibm:powervm_hypervisor:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·IBM

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-0986
  2. 2026-10-03 Alias added: GHSA-9qmj-p674-g42j

References

Patch 1

  • TI-2022-15241 IBM Power FW security bypass CVSS 3.1CRITICAL 9.8
  • TI-2023-14280 IBM PowerVM gain access CVSS 3.1CRITICAL 9.3
  • TI-2021-16362 IBM PowerVM Hypervisor FW860, FW940, and FW950 could allow an attacker that gains service… CVSS 3.1CRITICAL 9.1
  • TI-2021-16363 IBM PowerVM Hypervisor FW860, FW940, FW950, and FW1010, through a specific sequence of VM… CVSS 3.1HIGH 7.5
  • TI-2023-14281 IBM PowerVM Hypervisor denial of service CVSS 3.1HIGH 7.9
  • TI-2023-10961 IBM PowerVM Hypervisor information disclosure CVSS 3.1HIGH 7.5
See all 16 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences